Connect Action1 to Conduit

This walkthrough connects Action1 (RMM) to Conduit. You create API credentials in Action1, then add the Client ID and Secret — together with your region — as an organization connection in Conduit. Once connected, any MCP client your organization uses can call Action1 tools through Conduit’s gateway.

Action1 uses OAuth 2.0 client credentials under the hood: Conduit’s gateway exchanges your Client ID and Secret for a short-lived token on each session and caches it, so you never handle tokens yourself.

Menu labels can change

The Action1-portal steps below stay deliberately generic; menu labels can shift between Action1 releases. Follow Action1’s API credentials guide as the authority for creating credentials.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• An Action1 account that can create API credentials.
• To know your region — the Action1 cloud your account lives in. Credentials only authenticate against the region they were created in.

Step 1 — Create API credentials in Action1

1. Sign in to Action1.
2. Create API credentials under Settings → API Credentials (per Action1’s guide). Expected: a Client ID and a Secret, shown at creation.
3. Copy both values immediately. The secret is non-recoverable — Action1 shows it only at creation. If you lose it, you’ll need to create new credentials.

Caution

Copy the secret now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the secret, revoke the credentials in Action1 and create a new pair; the exposed secret becomes useless immediately.

Step 2 — Connect Action1 in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Action1 in the catalog (under RMM) and click Connect. Expected: a credential form with four fields.
3. Fill the fields:
   • API Key (required) — the Client ID from Step 1 (the form hints “Client ID from Action1 → Settings → API Credentials”).
   • Secret (required) — the secret from Step 1 (non-recoverable — copy on creation).
   • Region (required) — pick the Action1 cloud your account lives in: NorthAmerica (app.action1.com), Europe (app.eu.action1.com), AsiaPacific (app.ap.action1.com), or Australia (app.au.action1.com). Match it to the host you sign in to.
   • Default Organization ID (optional) — for single-tenant use, pin tool calls to one Action1 organization. Leave blank for multi-tenant use.
4. Click Connect. Expected: Conduit mints a token against your region immediately and shows a green Connected status. Bad credentials or the wrong region are rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this Action1 connection. (For per-technician keys, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Action1 tool, such as listing organizations or endpoints. You should get real data back, and the call appears in your audit log with the correct user, vendor (action1), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid Action1 API Key or Secret for the selected region.”	The Client ID/Secret pair is wrong, revoked, or was created in a different region than the one selected. Verify both values and match the region to the host you sign in to.
Connect fails with “Unknown Action1 region: <value>”	The region value isn’t one Conduit recognizes. Re-open the form and pick a region from the dropdown.
Connect fails with “Action1 OAuth token endpoint returned HTTP <status>.”	Action1’s token endpoint returned an unexpected error — often a transient Action1-side issue. Retry after a moment.
Tool calls return 403 “no credentials for vendor”	Action1 isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has credentials.
Tool calls land in the wrong Action1 organization	A Default Organization ID is pinned on the connection. Update or clear it at /org/catalog for multi-tenant use.
Need to rotate the credentials	Create a new credential pair in Action1, then update the connection at /org/catalog. Remember the new secret is only shown once.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.
• Action1 API documentation — full API reference.